This documents how to encrypt the root filesystem of your BLAG box using a USB key.
It's a bit involved...You'll need to be handy on the command line, know grub, mke2fs, etc.
The idea behind this setup is to have /no/ unencrypted data on your

This HOWTO shows you how to take a completely new hard disk and encrypt its entire contents using dm-crypt and LUKS. Actually, it's the partitions that are encrypted, not the disk itself (details below). So if you wish, you can make multiple partitions with different passphrases, or some not encrypted. With a bit of work, you can adapt these instructions to make an encrypted partition on an existing disk, possibly with some unencrypted partitions on the same disk.